CVE-2015-3226: XSS Vulnerability in ActiveSupport::JSON.encode
(updated )
When a Hash
containing user-controlled data is encoded as JSON (either through Hash#to_json
or ActiveSupport::JSON.encode
), Rails does not perform adequate escaping that matches the guarantee implied by the escape_html_entities_in_json
option (which is enabled by default). If this resulting JSON string is subsequently inserted directly into an HTML page, the page will be vulnerable to XSS attacks.
References
Detect and mitigate CVE-2015-3226 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →